[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.3.2 KAS2-Party_V-confirmation                                                                                | ... 3.3.2 and 8. 3.3.2 can be used to provide assurance to a key-pair owner, acting as party U, that both parties are in possession of the correct private key; i.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings:

igned by a trusted CA provides a mechanism that may be used for enabling the credential to be verified and revoked. |
| Certificate Authority (CA)            | Issues and signs certificates as needed.
| Supports (integral to) PR.AC- 6: Identities are proofed and bound to credentials and asserted in interactions                                               | If the device credential is an X.509 certificate (e.g., an IDevID) that is signed by a CA, this certificate binds the device's credential to the device's identity. |
| Application- Layer Onboarding Service | After the device connects to the network, this component interacts with the device using… | Is Supported by (precedes) ID.AM-2: Software platforms and applications within the organization are inventoried                                             | In some application-layer onboarding mechanisms, the IoT device must be prepared for application-layer onboarding during the factory provisioning process. In these cases, the… |

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Module-Lattice-Based Digital Signature Standard provide? (Part 3)

[Assistant]
user who possesses the private key can generate a signature that can be verified by the corresponding public key. The digital signature is provided to the intended verifier along with the signed data.
The verifying entity verifies the signature by using the claimed signatory's public key. Similar procedures may be used to generate and verify signatures for both stored and transmitted data. This standard specifies several parameter sets for ML-DSA that are approved for use. Additional parameter sets may be specified and approved in future NIST Special Publications. 4. Approving Authority. Secretary of Commerce. 5. Maintenance Agency. Department of Commerce, National Institute of Standards and Technology, Information Technology Laboratory (ITL). 6. Applicability. This standard is applicable to all federal departments and agencies for the protection of sensitive unclassified information that is not subject to section 2315 of Title 10, United States Code, or section 3502 (2) of Title 44, United States Code. Either this standard, FIPS 205, FIPS 186-5, or NIST Special Publication 800-208 shall be used in designing and implementing public-key-based signature systems that federal departments and agencies operate or that are operated for them under contract. In the future, additional digital signature schemes may be specified and approved in FIPS or NIST Special Publications. The adoption and use of this standard are available to private and commercial organizations. 7. Applications. A digital signature algorithm allows an entity to authenticate the integrity of signed data and the identity of the signatory. The recipient of a signed message can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time.

Module-Lattice-Based Digital Signature Standard

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

' OS fingerprints and application error messages. Some products can also prevent sensitive information such as social security numbers and credit card numbers from being displayed on Web server pages.
Some host-based IDPSs offer additional capabilities related to intrusion detection and prevention, such as enforcing restrictions on the use of removable media, detecting the activation or use of audiovisual devices, automatically hardening hosts on an ongoing basis, monitoring the status of running processes and restarting failed ones, and performing network traffic sanitization.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Recommendation for Obtaining Assurances for Digital Signature Applications:

3.2.1). 3.2.1 Assigning the assurance\_time for the Regeneration of Keys

Section 6. 3.2.1, then the initial assurance level should be assigned as follows:

- a.

Recommendation for Obtaining Assurances for Digital Signature Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Vetting the Security of Mobile Applications:

ut notice, performance impact (e.g., battery), etc. prior to allowing them to be hosted in their app market. The level and type of reviews conducted are opaque to consumers and the federal government.
Furthermore, these app markets serve a global customer base that numbers in the billions and their reviews of apps are consumer- and brand-focused. Enterprise organizations  federal agencies, regulated industries, other non-governmental organizations  that plan to use consumer apps for their business will need to make risk-based decisions for app acquisition based on their own security, privacy and policy requirements and risk tolerance.

Vetting the Security of Mobile Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.:

Contractual requirements are the principal mechanism for setting a baseline foundation to manage cyber supply chain risks. During the onboarding process, new suppliers are subject to a detailed security assessment. These assessments are based on specific security council priorities, the NIST Cybersecurity Framework (NIST CSF) v , International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 28001 vi , and other standards and best practices. The assessment ensures that all supplier employees receive security training and that the assessment team inspects the supplier's factory and warehouse facilities to confirm that unauthorized personnel cannot access Palo Alto Networks components. Suppliers must also demonstrate conformance to relevant requirements, such as FIPS, CPA, and the U.S. Customs and Border Protection's (CBP) Customs-Trade Partnership Against Terrorism (CTPAT) program. In addition to supplier onboarding and annual security assessments, suppliers are contractually obligated to disclose component vulnerabilities, data loss, and security incidents to Palo Alto Networks. This process provides the SCRC team a more complete view of the supplier's cybersecurity posture, including real-time alerts of a potential incident. Strategic suppliers must use Palo Alto Networks' cybersecurity products to provide confidence in the supplier's cyber incident detection and response capabilities. Palo Alto Networks ensures consistent quality management and product security with a wide range of handling policies. All materials related to the production of Palo Alto Networks products must be stored in facilities with strict access controls and 24/7 physical and electronic monitoring. The CM is required to perform complete background, reference, and employment history checks for every candidate before they may access and work on Palo Alto Networks products.

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.6 (NIST 3.3.6)?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

3.3.6, 3. 3.3.6, 3.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Storage Encryption Technologies for End User Devices:

| Introduction ......................................................................................................................1-1 | Introduction ......................................................................................................................1-1 | Introduction ......................................................................................................................1-1 | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience..................................................................................................................1-1 | | | | 1.4 | Document Structure.................................................................................................1-1 | | | 2.

Guide to Storage Encryption Technologies for End User Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

The new format for assessment procedures introduced in Special Publication (SP) 800-53A Revision 4, is
further improved in this revision (SP 800-53A Revision 5). The format continues to reflect the
decomposition of assessment objectives into more granular determination statements wherever possible,
thus providing the capability to identify and assess specific parts of security and privacy controls. Updates
to SP 800-53A Revision 5:

CHAPTER ONE INTRODUCTION ............................................................................................................... 1
1.1   PURPOSE AND APPLICABILITY .......................................................................................................... 1
1.2   TARGET AUDIENCE ............................................................................................................................ 4
1.3   RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4
1.4   ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5
CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6
2.1   ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6
2.2   CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7
2.3   BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8
2.4   ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11
CHAPTER THREE THE PROCESS ............................................................................................................. 19
3.1   PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ...............................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

| 2.10.3 Derived PIV Credential Reissuance and Update Requirements . . . . . . . . . . . . . . . . . | . 27   |
|----------------------------------------------------------------------------------------------------------------------------|--------|
| 2.11 PIV Privacy Requirements . . . . | . 28   |
| 3. PIV System Overview . . . . . . . . . . . . . . . . . . . . . . . . . . | . 30   |
| 3.1 Functional Components . . . . . . . . . . . . . . . . . . . . . . . | . 30   |
| 3.1.1 PIV Front-End Subsystem . . . . . . . . . . . . . . . . . . | . 31   |
| 3.1.2 PIV Issuance and Management Subsystem . . . . . . . . . . . . . . . . . | . 32   |
| 3.1.3 PIV Relying Subsystem . . . . . . . . . . . | . 34   |
| 3.2 PIV Card Lifecycle Activities . . . . . . . . . . . . . . . . . . . . | . 35   |
| 3.3 Connections Between System Components . . . . . . . . . . . . . | . 37   |
| 4. PIV Front-End Subsystem . . . . . . . . . . . . . . . . . . . . . . . | . 39   |
| 4.1 PIV Card Physical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . | . 39   |
| 4.1.1 Printed Material . . . . . . . . . . . . . . . . | . 39   |
| 4.1.2 Tamper-proofing and Resistance . . . . . . . . . . . . . . | . 39   |
| 4.1.3 Physical Characteristics and Durability . . . . . . . . . . . . . | . 40   |
| 4.1.4 Visual Card Topography . . . . . . . . . . . . . . . . . . . | . 42   |
| 4.1.5 Color Representation . . . . . . . . . . . . . . . . . | . 58   |
| 4.2 PIV Card Logical Characteristics . . . . . . . . . . . . . . . . . . . . . | . 58 . |
| 4.2.1 Cardholder Unique Identifier . . . . . . . . . . . . . | 60     |
| 4.2.2 Cryptographic Specifications . . . . . . . . . . . . . . . . | . 61   |
| 4.2.3 Biometric Data Specifications . . . . . . . . . . . . . . . . . . . | . 65   |
| 4.2.4 PIV Unique Identifiers . . . . . . . . . . . . . . . . . . . . . . | . 67   |
| 4.3 PIV Card Activation . . . . . . . . . . . . . . . . . . | . 68   |
| 4.3.1 Activation by Cardholder . . . . . . . . . . . . . . . .

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guidelines on Electronic Mail Security:

| 5.3 Checklist for Securing the Mail Server Operating System.......................................5-7 | 5.3 Checklist for Securing the Mail Server Operating System.......................................5-7 | | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------| | Securing Mail | Servers and | Content................................................................................6-1 | | 6.1 Hardening the Mail Server Application.....................................................................6-1 | 6.1 Hardening the Mail Server Application.....................................................................6-1 | | | 6.1.1 | Securely Installing the Mail Server | ...............................................................6-1 | | 6.1.2 | Configuring Operating System and Mail Server Access Controls | ................6-1 | | | Protecting Email from Malware................................................................................6-3 | | | 6.2 6.2.1 | Malware Scanning........................................................................................6-5 | | | 6.2.2 | Content Filtering | ...........................................................................................6-9 | | 6.2.3 | User Awareness | .........................................................................................6-12 | | 6.3 | Blocking Spam-Sending Servers | ...........................................................................6-13 | | 6.4 | Authenticated Mail Relay | .......................................................................................6-14 | | 6.5 | Secure Access.......................................................................................................6-14 | | | 6.6 | Enabling Web Access............................................................................................6-15 | | | 6.7 | Checklist for Securing Mail Servers and Content | ..................................................6-16 | | Implementing a Secure Network Infrastructure ............................................................7-1 | Implementing a Secure Network Infrastructure ............................................................7-1 | | | 7.1 | Network Composition and Structure | ........................................................................7-1 | | | 7.1.1 Inadvisable Network Layout | .........................................................................7-1 | | 7.1.2 | Demilitarized Zone........................................................................................7-1 | | | | 7.1.4 Management Network | ..................................................................................7-5


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Platform Firmware Resiliency Guidelines:

| Introduction...........................................................................................................................
1   | Introduction...........................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Methods and Techniques:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement  and  standards  infrastructure.  ITL  develops  tests,  test  methods,  reference  data,  proof  of concept  implementations,  and  technical  analyses  to  advance  the  development  and  productive  use  of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive  unclassified  information  in  Federal  computer  systems.  This  Special  Publication  800-series reports  on  ITL's  research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative activities with industry, government, and academic organizations.

Recommendation for Block Cipher Modes of Operation_ Methods and Techniques


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security Considerations for Remote Electronic UOCAVA Voting:

.. 4             | 2 GENERAL ARCHITECTURE............................................................ 4             | 2 GENERAL ARCHITECTURE............................................................
4             |
| 2.1                                                                                | SYSTEM COMPONENTS                                                                                | ....................................................................4                            |
| 2.2                                                                                | AUTHORIZED USERS.......................................................................7         |                                                                                |
| 2.3                                                                                | THREAT SOURCES..........................................................................8        |                                                                                |
| 3 OVERVIEW................................................................................ 12    | 3 OVERVIEW................................................................................ 12    | 3 OVERVIEW................................................................................ 12    |
| 4                                                                                | CONFIDENTIALITY....................................................................

Security Considerations for Remote Electronic UOCAVA Voting


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to BIOS Protection Guidelines:

| Introduction.......................................................................................................................1-1 | | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Authority ...................................................................................................................1-1 | | | 1.2 | Purpose and Scope..................................................................................................1-1 | | | 1.3 | Audience ..................................................................................................................1-2 | | | 1.4 | Document Structure .................................................................................................1-2 | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Assessing Security and Privacy Controls in Information Systems and Organizations provide?

[Assistant]
NIST Special Publication 800-53A
Revision 5

Assessing Security and Privacy Controls in
Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53Ar5

 NIST Special Publication 800-53A
Revision 5

 Assessing Security and Privacy Controls
in Information Systems and
Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53Ar5

January 2022

National Institute of Standards and Technology
James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce
for Standards and Technology & Director, National Institute of Standards and Technology

U.S. Department of Commerce
Gina M. Raimondo, Secretary

Authority

This publication has been developed by NIST to further its statutory responsibilities under the
Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines,
including minimum requirements for federal information systems. Such information security
standards and guidelines shall not apply to national security systems without the express
approval of the appropriate federal officials exercising policy authority over such systems. This
guideline is consistent with the requirements of the Office of Management and Budget (OMB)
Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made
mandatory and binding on federal agencies by the Secretary of Commerce under statutory
authority. Nor should these guidelines be interpreted as altering or superseding the existing
authorities of the Secretary of Commerce, OMB Director, or any other federal official. This
publication may be used by nongovernmental organizations on a voluntary basis and is not
subject to copyright in the United States.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Hardware Security Failure Scenarios_ Potential Hardware Weaknesses:

WE-1196).............................................44                                                                                |
| Fig.
21.HWCWEs under the category Security Primitives and Cryptography Issues (CWE-1205).........45                                                                                |
| Fig. 22. HWCWEcomplete graph with View-1003 pillar and class CWEs that are not in View-1194 highlighted ..........................................................................................................................46                     |
| Fig. 23. HWCWEcomplete graph with View-1003 base CWEs that overlap with View-1194 highlighted ........................................................................................................................................................48 |
| Fig. 24. HWCWEcomplete graph with memory-related weaknesses highlighted ...............................49                                                                                |
| Fig. 25. View-699 CWEs that overlap with View-1194 highlighted......................................................50                                                                                |
| Fig. 26. The 12 CWEs in both View-1194 and View-699......................................................................52                                                                                |
| Fig. 27. HWCWECategory Graph: Improper Access Control ..............................................................69                                                                                |

Hardware Security Failure Scenarios_ Potential Hardware Weaknesses


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

to apply significant compensating controls. 4. What are the physical, logical access, network, and other requirements of the IoT device and how do they relate to key device cybersecurity requirements?
An understanding of how the IoT device will interact with the digital and physical worlds is important to understanding whether the device should be used by the organization and, if so, the cybersecurity risks and corresponding mitigations that are practical, possible, and appropriate. For example, knowing the endpoints (both internet domains and local devices) the IoT device must connect to can help an organization ensure all connections the device will make (and the logical access via those endpoints) are acceptable within the organization's security policy. Physical requirements, such as the need to access the device for maintenance or diagnostics may conflict with how some devices are deployed (e.g., if they must be placed in an inaccessible location making physical maintenance difficult or impossible).

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.7 (NIST 3.3.7)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.3.7 SP800161 : SA-15, SA-15(1), SA-15(11)                                                                                |
| Implement and Maintain Secure Environments for Software Development (PO.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators:

Let df be the derivation function specified in Section 10.3.2. When instantiation is performed using this method, a nonce is required, whereas using the method in Section 10.2.1.3.1 does not require a nonce, since full entropy is provided when using that method.

Let df be the derivation function specified in Section 10.3.2.

Let df be the derivation function specified in Section 10.3.2.

Recommendation for Random Number Generation Using Deterministic Random Bit Generators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

|     | 5.3.3                                                                                | Support for Multicast .................................................................................. | 5-8                                                                                |
|-----|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|
|     | 5.3.4                                                                                | Status of IPsec and On-Going                                                                                | Work........................................................... 5-9                             |
|     | 5.3.5                                                                                | Security Ramifications..............................................................................

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

| Publication Structure .............................................................................................
| 1-2                                                                                |
|                                                                                |                                                                                | 2-1                                                                                |
| Establishing and Organizing a Forensics Capability.................................................. | Establishing and Organizing a Forensics Capability.................................................. | Establishing and Organizing a Forensics Capability.................................................. |
| 2.1                                                                                | The Need for Forensics......................................................................................... | 2-1                                                                                |
| 2.2                                                                                | Forensic Staffing ...................................................................................................

Guide to Integrating Forensic Techniques into Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

Networking equipment - All coordination between workcell components occurs through the installed network equipment. If this equipment degrades or ceases to function, production goals will be impacted.
| Reporting Method    | Description                                                                              | Frequency                            |
|---------------------|------------------------------------------------------------------------------------------|--------------------------------------|
| Risk Management log | A document to report the results of risk identification, analysis, and response planning | Yearly                               |
| CSET Report         | A document describing Risk assessment results                                            | Yearly                               |
| NamicSoft report    | A document containing results of Nessus vulnerability scans. | Manual/Post vulnerability assessment |

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products:

ain the IoT product and its product components during its lifetime, including after the period of security support (e.g., delivery of software updates and patches) from the IoT product developer. - c.
How an IoT product and its product components can be securely re-provisioned or disposed of. - d. Vulnerability management options (e.g., configuration and patch management and anti-malware) available for the IoT product or its product components that could be used by customers. - e. Additional information customers can use to make informed purchasing decisions about the security of the IoT product (e.g., the duration and scope of product support via software upgrades and patches).

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report:

|                                                                                | Introduction: Workshop Objective, Participants, and Agenda.......................................1                                                                                |
|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Workshop Session Highlights and Summaries................................................................5                                                                                |
| HPC                                                                                | Architecture and Security Posture ........................................................................5                                                                                |
|                                                                                | HPC Operator Security Experience...............................................................................6                                                                                |
|                                                                                | Risk Management Framework Development, Implementation, and Assessment.........7                                                                                |
| 2.3.1.

3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Foundational Cybersecurity Activities for IoT Device Manufacturers support CMMC certification?

[Assistant]
According to Foundational Cybersecurity Activities for IoT Device Manufacturers:

ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Internet of Things (IoT) devices often lack device cybersecurity capabilities their customersorganizations and individuals-can use to help mitigate their cybersecurity risks.

Foundational Cybersecurity Activities for IoT Device Manufacturers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines on Securing Public Web Servers:

Securing Web Content.....................................................................................................6-1 | |-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| | | 6.1 | Publishing Information on Public Web Sites | ............................................................6-1 | | | 6.2 | Observing Regulations about the Collection of Personal Information......................6-3 | | | | 6.3 | Mitigating Indirect Attacks on Content .....................................................................6-5 | | | | | 6.3.1 Phishing........................................................................................................6-5 | | | | | 6.3.2 Pharming | ......................................................................................................6-7 | | | 6.4 | Securing Active Content and Content Generation Technologies.............................6-8 | | | | | 6.4.1 Vulnerabilities with Client-Side Active Content Technologies | ....................6-10 | | | | 6.4.2 Vulnerabilities with Server-Side Content Generation Technologies...........6-12 | | | | | 6.4.3 Server-Side Content Generator Security Considerations...........................6-15 | | | | | 6.4.4 Location of Server-Side Content Generators | .............................................6-17 | | | | 6.4.5 Cross-Site Scripting Vulnerabilities | ............................................................6-17 | | | 6.5 | Checklist for Securing Web Content......................................................................6-18 | | | 7.

Guidelines on Securing Public Web Servers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Best Practices for Privileged User PIV Authentication:

This work resulted in the development of the CSIP [1]. A major gap identified by the CSIP is the delay in utilizing PIV credentials for logical access control and identity management on federal information systems, with an especially high priority for strengthening authentication for

The agency should compare the inventory to what is necessary to meet the organization's mission, and then remove all unnecessary privileged accounts, unnecessary permissions for privileged accounts, conflicting permissions for privileged accounts 11 , unnecessary user access to privileged accounts in accordance with the principle of least privilege and perform automated reviews of privileged user access. This should include, at a minimum, the following actions:

1. Remove all privileged account access from users who no longer require access to perform their assigned duties (e.g., system, network, or database administration). 2. Remove or disable all privileged accounts, including default and built-in accounts, that are no longer required. 3. Remove excessive access to privileged accounts from privileged users in accordance with the principles of least privilege and separation of duties. Access should be evaluated in the context of enterprise risk, not just application risk. For example, granting a privileged user access to both portions of a sensitive personally identifiable information (PII) data set divided between two systems may create excessive risk to the organization. 4. Remove all unnecessary permissions from privileged accounts. This includes restricting which commands, functions, or other elements can be performed through privileged accounts. It may also include additional restrictions to more strongly limit the use of privileged accounts via remote access (in other words, allow certain actions to be performed only from dedicated, highly-secured endpoint devices). 5. Enforce a maximum single session length for use of each privileged account.

Best Practices for Privileged User PIV Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies:

vision, hearing, or speech. Immersive technologies pose great benefits for the nation and may be critical to several sectors in the future such as education, industrial maintenance, and entertainment.
That said, many aspects of the technology space and standards are nascent, hindering specific discussion of cybersecurity and privacy. Though there are questions that need consideration related to cybersecurity and privacy of immersive technologies, as noted in the Section 4, existing NIST risk management guidelines, tools, and resources can support risk-based and ethical decisionmaking in the development and use of immersive systems, products, and services. Thus, participants in immersive technology ecosystems (e.g., product manufacturers and providers, supporting service providers, institutional and individual users) can leverage the existing NIST cybersecurity and privacy portfolio, either directly or through tailoring and profiling. Through this mechanism, as NIST has done before, practical application of cybersecurity and privacy risk management can be supported in the near term with new projects and research directions potentially identified through continued community engagement.

Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping:

KEY  WORDS:  authenticated  encryption;  authentication;  block  cipher;  computer  security; confidentiality; cryptography; encryption; information security; key wrapping; mode of operation.

Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

These guidelines do not give specific recommendations on steps that can be taken to make this determination. There are tools available (such as the Data Analytics Program [69]) that can provide information to system administrators that can be used to assess the impact of supporting or not supporting TLS versions prior to TLS 1.2. For example, DAP data on visitor OS and browser versions can help administrators determine what percentage of visitors to agency websites cannot negotiate recommended TLS versions by default.

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice RA.L2-3.11.1 (NIST 3.11.1)?

[Assistant]
According to Recommendation for Key Management_ Part 1 – General:

3.11.1 Private Ephemeral Keys... 3.11.1 Private Ephemeral Keys

Private ephemeral keys shall not be backed up or archived.

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

| CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1               | CHAPTERONE INTRODUCTION...................................................................................................... 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Computer Security Division 2005 Annual Report:

onal-level personnel. We also invite public and private organizations to submit their information security practices to be considered for inclusion on the list of practices maintained on the Web site.
Policies and procedures may be submitted to us in any area of information security, including accreditation, audit trails, authorization of processing, budget planning and justification, certification, contingency planning, data integrity, disaster planning, documentation, hardware and system maintenance, identification and authentication, incident  handling  and  response, life cycle, network  security, personnel  security, physical and environmental protection, production

Computer Security Division 2005 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

| | 5.3.3 | Distinguishing RSN and Pre-RSN WLANs.................................................5-11 | | |-----|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------| | 5.4 | Authentication Phase.............................................................................................5-12 | Authentication Phase.............................................................................................5-12 | | | | 5.4.1 | The IEEE 802.1X Framework: Port-Based Access Control........................5-12 | | | | 5.4.2 | Authentication with the | PSK.......................................................................5-14 | | | 5.4.3 | AS to AP Connections................................................................................5-15 | | | | 5.4.4 | Pre-Authentication and PMKSA Caching | ...................................................5-17 | | 5.5 | Key Generation and Distribution ............................................................................5-18 | Key Generation and Distribution ............................................................................5-18 | | | | 5.5.1 | 4-Way Handshake......................................................................................5-18 | | | | 5.5.2 | Group Key Handshake | ...............................................................................5-19 | | | Protected Data Exchange......................................................................................5-20 | Protected Data Exchange......................................................................................5-20 | | | 5.7 | Connection Termination.........................................................................................5-21 | Connection Termination.........................................................................................5-21 | | | | Summary................................................................................................................5-21 | Summary................................................................................................................5-21 | | | 6.

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to BIOS Protection Guidelines:

| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guide to General Server Security:

3.2.2 Information Systems Security Program Managers... 3.2.2 Information Systems Security Program Managers

The Information Systems Security Program Managers (ISSPM) oversee the implementation of and compliance with the standards, rules, and regulations specified in the organization's security policy.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.2.1. 3.2.1.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Verification and Test Methods for Access Control Policies_Models:

n the policy, model, and safety requirements may each describe their own space of permission conditions, and may not be congruent in one space as the initial relation illustrated examples in Figure 7.
The safety and liveness check can assure only the logic integrity of some rules against some safety requirements. The complete satisfaction of a model to its policy requires repair of coverage and confinement faults if any violations are detected by additional Coverage and Confinement Check (CCC), the second line of defense against such semantic faults.

Verification and Test Methods for Access Control Policies_Models


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Information Security Guide for Government Executives:

| Information Security Program Elements | Information Security Program Elements | |-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Awareness and Training | The security awareness and training program is a critical component of the information security program.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Vetting the Security of Mobile Applications:

| Functional Requirements | |----------------------------------------------------------------------| | Access to Platform Resources | | Anti-Exploitation Capabilities | | Cryptographic Key Functionality | | Cryptographic Operations | | Encryption of Sensitive Application Data | | Hyper Text Transfer Protocol Secure (HTTPS) | | Integrity for Installation and Update | | Network Communications | | Protection of Data in Transit | | Random Bit Generation | | Secure by Default Configuration | | Software Identification and Versions | | Specification of Management Functions | | Storage of Credentials | | Supported Configuration Mechanism | | Transport Layer Security Operations | | Use of Supported Services and Application Programming Interfaces | | Use of Third-Party Libraries | | User Consent for Transmission of Personally Identifiable Information | | X.509 Functionality | - Architecture, Design, and Threat Modeling Requirements - Data Storage and Privacy Requirements - Cryptography Requirements - Authentication and Session Management Requirements - Network Communication Requirements - Platform Integration Requirements - Code Quality and Build-Setting Requirements - Resilience Requirements | Criterion | Description | |------------------|-----------------------------------------------------------------------------------------------------------------------------| | Policies | The security, privacy and acceptable use policies; social media guidelines; and regulations applicable to the organization.

Vetting the Security of Mobile Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards:

------|
| Identify   | ID. AM                       | Asset Management                       |
| Identify   | ID. BE                       | Business Environment                   |
| Identify   | ID.
GV                       | Governance                             |
| Identify   | ID.RA                        | Risk Assessment                        |
| Identify   | ID.RM                        | Risk Management Strategy               |
| Identify   | ID.SC                        | Supply Chain Risk Management           |
| Protect    | PR.AC                        | Identity Management and Access Control |
| Protect    | PR.AT                        | Awareness and Training                 |
| Protect    | PR.DS                        | Data Security                          |
| Protect    | PR.IP                        | Information Protection and Procedures  |
| Protect    | PR.MA                        | Maintenance                            |
| Protect    | PR.PT                        | Protective Technology                  |
| Detect     | DE.AE                        | Anomalies and Events                   |
| Detect     | DE.CM                        | Security Continuous Monitoring         |
| Detect     | DE.DP                        | Detection Processes                    |
| Respond    | RS.RP                        | Response Planning                      |
| Respond    | RS.CO                        | Communications                         |
| Respond    | RS.AN                        | Analysis                               |
| Respond    | RS.MI                        | Mitigation                             |
| Respond    | RS.IM                        | Improvements                           |
| Recover    | RC.RP                        | Recovery Planning                      |
| Recover    | RC.IM                        | Improvements                           |
| Recover    | RC.CO                        | Communications                         |

Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2014 Annual Report provide? (Part 5)

[Assistant] | 11 | | CSD WORKIN NATIONAL AND INTERNATIONAL STANDARDS.................................................................................................12 | | | FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) IMPLEMENTATION PROJECT...........................................16 | | | BIOMETRIC STANDARDS AND ASSOCIATED CONFORMITY ASSESSMENT TESTING TOOLS..................................................17 | | | FEDERAL CYBERSECURITY RESEARCH & DEVELOPMENT (R&D).............................................................................................19 | | | SECURITY ASPECTS OF ELECTRONIC VOTING...........................................................................................................................19 | | | HEALTH INFORMATION TECHNOLOGY SECURITY.....................................................................................................................20 | | | SUPPLY-CHAIN RISK MANAGEMENT (SCRM) FOR INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT)................21 | | | NATIONWIDE PUBLIC SAFETY BROADBAND NETWORK (NPSBN) CYBERSECURITY............................................................22 | | | SECURITY OF CYBER-PHYSICAL SYSTEMS (CPS) .....................................................................................................................23 | | | SMART GRID CYBERSECURITY...................................................................................................................................................24 | | | CYBERSECURITY AWARENESS, TRAINING, EDUCATION, AND OUTREACH............................................................................25 | | | National Initiative for Cybersecurity Education (NICE)............................................................................................................................25 Computer Security Resource Center (CSRC) | ..............................................................................................................................................26 | | Federal Computer Security Program Managers' Forum...........................................................................................................................

Computer Security Division 2014 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity:

For example, conformance testing captures the technical description of the requirements in a standard and measures whether an implementation (product, process or service) faithfully fulfills these requirements. Conformance testing alone does not completely ensure the interoperability or performance of conforming products, processes, or services.  Therefore, interoperability and performance testing are also important aspects for procurements.  Interoperability testing tests one implementation with another to establish that they can work together properly. Performance testing measures the performance characteristics of an implementation, such as its throughput 9 or response time, 10 under various conditions.

In some instances, testing and attestation of products, processes, and services against established cybersecurity standards may help provide a level of assurance that a product, process, or service's stated security claim is valid. An example is the USG requirement for using cloud products that meet Federal cloud security requirements. Commercial assessment organizations, which are accredited for assessing cloud security, determine if a cloud

product conforms to the requirements.  This can be more cost-effective for Federal agencies than developing inhouse USG testing expertise.

Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2012 Annual Report provide? (Part 3)

[Assistant]
|
| Security Outreach and Integration Group................ | 5                                              |
| Security Testing, Validation, and Measurement Group...
| 6                                              |
| The Computer Security Division Implements the Federal Information Security Management Act of 2002......................................................7 |                                                |
| CSD's Programs/Projects for FY2012..................8                                                                                |                                                |
| CSD Work in National and International Standards.....

Computer Security Division 2012 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

unities) can be listed in descending order of their enterprise benefit in a similar way. Prioritization and risk evaluation must also consider the positive risks that might evolve from an opportunity.
Risk calculations are often based on analysis of both the cost of response and the benefit of proceeding. For example, while there have been many cybersecurity risks inherent to telework scenarios, organizations are increasingly realizing that a remote workforce brings positive benefits (e.g., reduced office space costs and utilities, reduced commuting time for employees, wider access to a skilled workforce). Understanding and calculating the various factors -such as through a strength, weakness, opportunity, and threat (SWOT) analysis -helps to prioritize all risks and evaluate available responses. Such an analysis must also keep in mind the consequences of failure to pursue an opportunity, even in light of certain negative risks. An organization that is considering creating a new product offering that works through a mobile device application must weigh the potential negative risks (e.g., intentional attacks by cyber criminals, software errors that might create customer support needs) against the positive risks (e.g., additional customer revenue and market share opportunities) made available through that offering. Basing risk considerations on benefits to and consequences on enterprise drivers supports mission-focused prioritization.

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report:

In the second presentation, Aron Warren from Sandia National Laboratories introduced the concept of a diskless HPC architecture. This innovative approach aims to minimize operational overhead while offering multiple advantages for enhancing security. By eliminating physical disks at most systems, it reduces the risk of data breaches or unauthorized access to sensitive information. Additionally, the diskless setup streamlines maintenance processes, reduces the attack surface, and enhances overall system resilience.

In summary, the panelists' recommendations emphasized the importance of comprehending the HPC operational environment. This includes documenting security and privacy requirements and keeping track of security and operational performance metrics, which will allow management to gain valuable insights into how well the HPC is performing in terms of both security and mission objectives. Furthermore, automation will help achieve consistent implementations for standardized and objective requirements. Tools like Gitlab and Ansible play a significant role in facilitating the maintenance and sharing of scripts that support the consistent implementation of security requirements unique to HPC environments.

- Software-based encryption
- Patching and software maintenance
- Endpoint protection
- Anti-virus software
- Signature-based detection of malicious software

3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

| 1. | INTRODUCTION                  | INTRODUCTION                  | INTRODUCTION                  | INTRODUCTION                     | INTRODUCTION                     | INTRODUCTION                     | 1                                | INTRODUCTION                     | INTRODUCTION                     | INTRODUCTION                     | INTRODUCTION                     | INTRODUCTION                     |
|------------------------------|-------------------------------|-------------------------------|-------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|
| 2. | REFERENCES                    | REFERENCES                    | REFERENCES                    | REFERENCES                       | REFERENCES                       | REFERENCES                       | 1                                | REFERENCES                       | REFERENCES                       | REFERENCES                       | REFERENCES                       | REFERENCES                       |
| 3. | DEFINITIONS AND ABBREVIATIONS | DEFINITIONS AND ABBREVIATIONS | DEFINITIONS AND ABBREVIATIONS | DEFINITIONS AND ABBREVIATIONS    | DEFINITIONS AND ABBREVIATIONS    | DEFINITIONS AND ABBREVIATIONS    | 2                                | DEFINITIONS AND ABBREVIATIONS    | DEFINITIONS AND ABBREVIATIONS    | DEFINITIONS AND ABBREVIATIONS    | DEFINITIONS AND ABBREVIATIONS    | DEFINITIONS AND ABBREVIATIONS    |
| 4.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 2)

[Assistant]
lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-40 Rev. 4 Natl. Inst. Stand. Technol. Spec. Publ. 800-40r4, 28 pages (April 2022) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-40r4

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

Similarly, the RMF also demonstrates this bilateral relationship.  For example, every task within the Prepare step of the RMF aligns with the Cybersecurity Framework Core.  Specifically, the P-2 Risk Management Strategy aligns with the Cybersecurity Framework Core [Identify Function at ID.RM; ID.SC].  Other RMF examples include: Task P-4, Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles, aligns with the Cybersecurity Framework Profile construct; and Task R-5, Authorization Reporting, and Task M-5, Security and Privacy Reporting, support OMB reporting and risk management requirements organizationwide by using the Cybersecurity Framework constructs of Functions, Categories, and Subcategories. 2

By aggregating cybersecurity findings, gaps, and vulnerabilities into a centralized record, agencies gain a combined view of cybersecurity risk and can make better informed risk decisions. Examples include determining how a system authorization decision might affect the agency as a whole, or how broader risk decisions might play out in a complex and connected infrastructure. An organization-wide record of risk enables consistent reporting. In some organizations, this centralized record is referred to as a 'risk register.' OMB Circular A-11 9 describes a risk register as 'a repository of risk information including the data understood about risks over time.' A-11 further explains, 'Typically, a risk register contains a description of the risk, the impact if the risk should occur, the probability of its occurrence, mitigation strategies, risk owners, and a ranking to identify higher priority risks' [15]. 10

Agencies often track managed vulnerabilities, vulnerability mitigation plans, and accepted vulnerabilities on a system-by-system basis. This information is in the system Security Authorization Package, which includes the system security plan (SSP), the security assessment report (SAR), and the plan of action and milestones (POA&Ms). 11

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

| DATE | TYPE | CHANGE | PAGE | |------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | 05-20-2019 | Editorial | Corrected contact information to indicate 'Applied Cybersecurity Division.' | i | | 05-20-2019 | Editorial | General formatting | All | | 05-20-2019 | Substantive | Changed '$1000' to 'Tens of thousands' in Table 7 | 14 | | 05-20-2019 | Substantive | Changed '$100,000' to 'Hundreds of thousands' in Table 7 | 14 | | 05-20-2019 | Substantive | Changed 'Minutes' to 'Hours' in Table 7 | 14 | | 05-20-2019 | Substantive | Deleted "Military Contractors" in Table 8 | 14 | | 05-20-2019 | Substantive | Deleted 'Address the security of protected information in its third-party relationships.' from ID.AM-5.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide for Conducting Risk Assessments:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. A threat is any circumstance or event with the potential to adversely impact organizational operations and assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, or modification of information, and/or denial of service. 22 Threat events are caused by threat sources. A threat source is characterized as: (i) the intent and method targeted at the exploitation of a vulnerability; or (ii) a situation and method that may accidentally exploit a vulnerability. In general, types of threat sources include: (i) hostile cyber or physical attacks; (ii) human errors of omission or commission; (iii) structural failures of organization-controlled resources (e.g., hardware, software, environmental controls); and (iv) natural and man-made disasters, accidents, and failures beyond the control of the organization. Various taxonomies of threat sources have been developed. 23 Some taxonomies of threat sources use the type of adverse impacts as an organizing principle.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0:

3.4.3                                                                                | Threats TOE and Environment jointly address ... 3.4.3 as follows:

Table 3. 3.4.3: Threats addressed jointly by the TOE and its environment

Table 3.

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Managing the Security of Information Exchanges:

Despite the advantages, information exchange exposes the participating organizations to risk. If the information exchange is not properly planned and managed, a failure to protect the information from a loss of confidentiality, integrity, or availability could compromise the information and associated systems. Similarly, if one of the systems is compromised, the exchanged information could be compromised, or an interconnection used to exchange information could be leveraged as a conduit to compromise the other system and information. The risk is underscored because, in most cases, each participating organization has little or no control over the operation and management of the other

The less expensive alternative is to connect systems over a public network (e.g., the internet) using a VPN. A VPN is a network that enables two or more parties to communicate securely across a public network by creating a private connection, or 'tunnel,' between endpoints. Information transmitted via VPN over a public network can be intercepted by unauthorized parties. However, the use of authentication and encryption helps ensure the confidentiality and integrity of the information

- Electronic/Digital File Transfers - Information can be exchanged via an electronic or digital file transfer,  the transmission of a file (information) between two systems via a file transfer (communications) protocol. Organizations consider the risk associated with the use of different file transfer protocols; file transfer protocols include file transfer protocol secure (FTPS), Hypertext Transfer Protocol Secure (HTTPS), and Secure Copy Protocol (SCP). - Email - Organizations often share information via email as file attachments.

Managing the Security of Information Exchanges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification:

| Introduction...............................................................................................................................1 | Introduction...............................................................................................................................1 | Introduction...............................................................................................................................1 | Introduction...............................................................................................................................1 | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------| | | Application of Cryptography in FIPS 201-3 ..................................................................................3 | Application of Cryptography in FIPS 201-3 ..................................................................................3 | | | | On-Card Cryptographic Requirements.........................................................................................5 | On-Card Cryptographic Requirements.........................................................................................5 | | | | 3.2.1.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

........................................................ 1               | CHAPTERONE INTRODUCTION......................................................................................................
1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY ................................................................................................... | 1                                                                                |
| 1.2                                                                                | TARGET AUDIENCE .................................................................................................................. | 2                                                                                |
| 1.3                                                                                | ORGANIZATIONAL RESPONSIBILITIES .........................................................................................

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to 2019 NIST_ITL Cybersecurity Program Annual Report:

ays. This project has resulted in

The Computer Forensics Tool Testing Program (CFTT) is a project of ITL's Software and Systems Division (SSD) and is supported by the Special Programs Office and DHS.
In FY 2019, several key advances were made to help address a critical need in the law enforcement community to ensure the reliability of computer forensic tools.

2019 NIST_ITL Cybersecurity Program Annual Report